---
schema: 1
kind: vulnerability
title: "CVE-2026-2291 — dnsmasq DNS-cache heap overflow is a pre-auth RCE, not just a DoS (Exodus exploit-dev write-up)"
headline: "Exodus demonstrates full RCE from the dnsmasq CVE-2026-2291 heap overflow that NVD scores as a DoS/cache-poisoning flaw"
summary: >
  Exodus Intelligence published (2026-07-20) a working heap-overflow-to-RCE exploit chain for
  CVE-2026-2291 in dnsmasq's DNS-reply caching path, demonstrating full remote code execution on an
  OpenWrt target — materially worse than the DNS-cache-poisoning/DoS impact NVD's CVSS 7.3 implies.
  The flaw was fixed upstream in dnsmasq 2.92rel2 / 2.93 on 2026-05-11; dnsmasq is the default DNS/DHCP
  forwarder on OpenWrt and countless embedded-Linux gateways and routers, so patch-verification exposure
  across CH/EU network and OT-adjacent estates is broad.
discovered_at: "2026-07-21T04:39:00Z"
event_date: "2026-07-20"
run_id: 2026-07-21T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, poc-public, patch-available]
regions: [global]
sectors: [energy, water, transport, telco, public-sector]
entities: []
techniques: [T1190]
affected_products: ["dnsmasq"]
cves:
  - id: CVE-2026-2291
    cvss: "7.3"
    epss: null
    type: memory-corruption
    vector: user-interaction
    auth: pre-auth
    status: [poc-public, patch-available]
    affected: "< 2.92rel2 / < 2.93"
    fixed: "2.92rel2 / 2.93 (2026-05-11)"
sources:
  - url: "https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/"
    publisher: "Exodus Intelligence"
    date: "2026-07-20"
    role: primary
closed_sources: []
evidence:
  - quote: "The root cause of the vulnerability is an unsafe strcpy() when a domain name is cached."
    publisher: "Exodus Intelligence"
verification: single-source
sourcing_note: "Exodus Intelligence's exploit-development write-up is the sole substantive source for the working RCE chain (Admiralty B research lab, first-party analysis of its own finding). NVD's published CVSS 7.3 and the patched versions are auto-referenced from the CVE record and are not cited as a source (NVD per-CVE pages are not citable). The impact discrepancy (Exodus: full RCE; NVD's published scoring: cache-poisoning/DoS) is the entry's central point — triaging on the NVD 7.3 alone understates it."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Verify dnsmasq is at 2.92rel2 / 2.93 or later on every OpenWrt / embedded-Linux gateway, router and NetworkManager-DNS host in the estate — Exodus's public chain shows the CVSS-7.3 'DoS/cache-poisoning' bug is a pre-auth RCE, so any patch deferral made on the DoS framing should be revisited now."
migrated_from: null
---

Exodus Intelligence published a full exploit-development write-up for CVE-2026-2291, a heap buffer overflow in dnsmasq's DNS-reply caching function `really_insert()` (`src/cache.c`). When dnsmasq converts a domain name from DNS wire format to an escaped C string for caching, the escaping can double the string length, but the destination `bigname` buffer — fixed at 1,025 bytes — is never resized, and an unchecked `strcpy()` then overflows it: "the length of the string is not checked to ensure it does not exceed the size of the bigname buffer" ([Exodus Intelligence, 2026-07-20](https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/)). The published chain sends three attacker-controlled domain names in sequence (resolved via an attacker-influenced upstream response) to groom the heap, overflow an adjacent chunk's pointer, mount a write-what-where against `ld.so` function pointers, and take control of execution — full RCE on the OpenWrt demonstration target. No local access is needed: the attacker only requires a client behind the vulnerable resolver to look up an attacker-influenced name.

The significant point for defenders is the impact gap. NVD's published scoring puts CVE-2026-2291 at CVSS 7.3 with a low-impact vector consistent with cache poisoning or denial of service; Exodus's chain shows the practical ceiling is remote code execution ([Exodus Intelligence, 2026-07-20](https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/)). There is no confirmed in-the-wild exploitation — this is researcher-published offense, not observed attack activity — and the bug was already patched upstream in dnsmasq 2.92rel2 / 2.93 on 2026-05-11. **Defender takeaway:** dnsmasq is embedded far more widely than its low profile suggests (OpenWrt, consumer/SME routers, embedded-Linux and OT-adjacent gateways, and NetworkManager's DNS backend on many distributions), so the exposure question is patch coverage on network appliances that are easy to forget. Hunt DNS-resolver logs for anomalous escaped-character-heavy response domain names and for unexpected dnsmasq process crashes or restarts, which are a plausible precursor signal where a heap-corruption attempt fails partway.